1943 matches found
UBUNTU-CVE-2022-2393
A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-based authentication is enabled. This flaw allows an authenticated attacker on the adjacent network to impersonate another user within the scope of the domain, but they would not b...
CVE-2021-40012
Vulnerability of pointers being incorrectly used during data transmission in the video framework. Successful exploitation of this vulnerability may affect confidentiality...
HUAWEI EMUI 安全漏洞
HUAWEI EMUI is an Android-based mobile operating system developed by China's Huawei HUAWEI. version 12.0.0 of HUAWEI EMUI has an information disclosure vulnerability that stems from the improper use of pointers during data transfer in the video framework, which is used by attackers to affect devi...
CVE-2022-31554
The rohitnayak/movie-review-sentiment-analysis repository through 2017-05-07 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...
PT-2022-11134 · Huawei · Emui +2
Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: The issue concerns the incorrect use of pointers during data transmission in the video framework, which may impact confidentiality upon successful exploitation. Recommendations: At the...
Authorization
Incorrect authorization in GitLab EE affecting all versions from 10.7 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allowed an attacker already in possession of a valid Deploy Key or a Deploy Token to misuse it from any location to access Container Registries even when IP...
The vulnerability of the PingID software for multi-factor authentication of applications involves improper use of privileged APIs, allowing an attacker to escalate their privileges.
The vulnerability of the PingID software for multi-factor authentication of applications relates to the improper use of privileged APIs. Exploiting this vulnerability could allow an attacker to enhance their privileges...
CVE-2022-2246
DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage...
CVE-2022-2023
Incorrect Use of Privileged APIs in GitHub repository polonel/trudesk prior to 1.2.4...
AssetLogic's _swapAssetOut can fail on the one step approval
Lines of code Vulnerability details swapAssetOut performs one step approval for an arbitrary assetIn before calling pool's swapExactOut. As ERC20 that do not allow approval race condition prohibit setting approval to a new positive value when allowance is positive already, this call will fail if...
Owner can sweep any token
Lines of code Vulnerability details Impact Admin can sweep any token even if the token is in use by the contract. Ideally only non blacklisted tokens should be allowed by unlockTokens function function unlockTokensIERC20 token external override onlyOwner uint256 amount = token.balanceOfaddressthi...
CVE-2021-41411
drools =7.59.x is affected by an XML External Entity XXE vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability...
CVE-2021-35121
An array index is improperly used to lock and unlock a mutex which can lead to a Use After Free condition In the Synx driver in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile...
DEBIAN-CVE-2022-32511
jmespath.rb aka JMESPath for Ruby before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable...
Incorrect use of privileged APIs to steal victim's account
Description When user can edit their profile -- Incorrect use of privileged APIs to steal victim's account Proof of Concept 1. Login with hacker's account, get the request when edit profile 2. Replace the endpoint and email with victim's one 3. Send the request. POC video:...
CVE-2022-1936
Incorrect authorization in GitLab EE affecting all versions from 12.0 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1 allowed an attacker already in possession of a valid Project Deploy Token to misuse it from any location even when IP...
CVE-2022-1935
Removed by vendor...
PT-2022-14201 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab EE versions 12.0 through 14.9.5 GitLab EE versions 14.10.0 through 14.10.3 GitLab EE versions 15.0.0 Description: The issue is related to incorrect authorization in GitLab EE, allowing an attacker with a valid Project Deploy Token to...
Twitter fined $150M after using 2FA phone numbers for marketing
The Federal Trade Commission FTC and the Department of Justice DOJ have ordered Twitter to pay a $150M penalty for using users account security data deceptively. The deception violates an FTC order from 2011, that bars Twitter from "misleading consumers about the extent to which it protects the...